CVE-2026-56348: Typeorm Unscoped Private Or Conditioncve-2026-56348-typeorm-unscoped-private-or-condition
Detected a TypeORM query using an unscoped OR condition to fetch potentially private or sensitive records globally. In TypeORM, an array in `where` is interpreted as an OR condition. Providing an object restricted only to the type (e.g., `{ type: 'personal' }`) or using a `.where().orWhere()` chain lacking explicit `AND` constraints fails tenant separation,
